Skip to content
Noroxi

WP-DownloadManager

wp-downloadmanager · plugin

Known security vulnerabilities for WP-DownloadManager. Find out in seconds which version runs on your site with WP Lens.

11 known vulnerabilities

1 exploitable without logging in · latest Aug 5, 2026

Listed on wordpress.org · latest 2.0.2 · last updated Oct 2, 2026 · 3K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2026-18933high privilege≤ 1.69

    wp-downloadmanager - Unrestricted File Upload via Missing Extension/MIME Validation and Path Traversal

    High 7.2

  • CVE-2025-10747admin≤ 1.68.11

    WP-DownloadManager <= 1.68.11 - Authenticated (Admin+) Arbitrary File Upload

    High 7.2

  • CVE-2025-4799admin≤ 1.68.10

    WP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File Deletion

    High 7.2

  • CVE-2024-47341unauthenticated · needs a click≤ 1.68.8

    WordPress WP-DownloadManager plugin <= 1.68.8 - Reflected Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2013-2697

    Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager plugin before 1.61 for WordPress allows remote attackers to hijack

    Medium 6.8

  • CVE-2026-2426admin≤ 1.69

    WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parameter

    Medium 6.5

  • CVE-2022-25606high privilege≤ 1.68.5

    WordPress WP-DownloadManager plugin <= 1.68.5 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

    Medium 5.4

  • CVE-2022-25605high privilege≤ 1.68.6

    WordPress WP-DownloadManager plugin <= 1.68.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

    Medium 5.4

  • CVE-2021-44760admin≤ 1.68.6

    WordPress WP-DownloadManager plugin <= 1.68.6 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2025-4798admin≤ 1.68.10

    WP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File Read

    Medium 4.9

  • CVE-2026-2419admin≤ 1.69

    WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'download_path' Parameter

    Low 2.7

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory